CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
20007_office_system, 27mhz_wireless_keyboard, 365_apps, 3d_builder, 3d_viewer, Access, Accessibility_insights_for_android, Accessibility_insights_for_web, Access_multilingual_user_interface_pack, Active_directory
2020-08-24
N/A
7.8 HIGH
** DISPUTED ** The MSI installer for Python through 2.7.16 on Windows defaults to the C:Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:Python27 access control or choose a different directory, because backwards compatibility requires that C:Python27 remain the default for 2.7.x.
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
Fcm-mb40_firmware, Fcm-mb40, Fortiap-s, Fortiap-w2, Fortiap-u, Fortirecorder_firmware, Fortirecorder_100d, Fortirecorder_200d, Fortirecorder_400d, Antivirus_engine
2020-08-24
N/A
8.8 HIGH
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
Fcm-mb40_firmware, Fcm-mb40, Fortiap-s, Fortiap-w2, Fortiap-u, Fortirecorder_firmware, Fortirecorder_100d, Fortirecorder_200d, Fortirecorder_400d, Antivirus_engine
2019-07-09
N/A
8.8 HIGH
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
Fcm-mb40_firmware, Fcm-mb40, Fortiap-s, Fortiap-w2, Fortiap-u, Fortirecorder_firmware, Fortirecorder_100d, Fortirecorder_200d, Fortirecorder_400d, Antivirus_engine
2020-08-24
N/A
9.8 CRITICAL
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1322.
Fcm-mb40_firmware, Fcm-mb40, Fortiap-s, Fortiap-w2, Fortiap-u, Fortirecorder_firmware, Fortirecorder_100d, Fortirecorder_200d, Fortirecorder_400d, Antivirus_engine
2019-07-09
N/A
5.9 MEDIUM
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
Fcm-mb40_firmware, Fcm-mb40, Fortiap-s, Fortiap-w2, Fortiap-u, Fortirecorder_firmware, Fortirecorder_100d, Fortirecorder_200d, Fortirecorder_400d, Antivirus_engine
2020-08-24
N/A
7.2 HIGH
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.